How does DHCP snooping work, and what do trusted and untrusted ports mean?
Show the answer
Say this first
DHCP snooping turns the switch into a DHCP filter. Every port is untrusted by default; I mark only the ports toward the real DHCP server or relay as trusted, usually the uplinks. On untrusted ports the switch drops DHCP server messages (OFFER, ACK, NAK), so a rogue server on an access port cannot hand out leases, and it can rate-limit DHCP to slow a starvation attack. From the ACKs it sees, it builds a binding table of MAC, IP, lease, VLAN and port. That table is what Dynamic ARP Inspection and IP Source Guard check against.
Go deeper
What it checks on untrusted ports
- Drops server-to-client messages: DHCPOFFER, DHCPACK, DHCPNAK.
- Drops DHCPRELEASE and DHCPDECLINE for a binding that lives on a different port, so one client cannot release another's lease.
- Checks that the frame's source MAC equals the client hardware address inside the DHCP packet
(
ip dhcp snooping verify mac-address, on by default). - Optional rate limit in packets per second. Exceeding it err-disables the port.
- Inserts DHCP option 82 by default on Catalyst switches, which can upset upstream relays (covered in the pitfalls question).
Configuration
ip dhcp snooping vlan 10,20
ip dhcp snooping
ip dhcp snooping database flash:dhcp-snooping.db
!
interface GigabitEthernet1/0/48
description Uplink to DSW1
ip dhcp snooping trust
!
interface range GigabitEthernet1/0/1 - 46
ip dhcp snooping limit rate 15Both the global command and the per-VLAN command are needed. For an EtherChannel uplink, put trust
on the port-channel interface.
The binding table
ASW1# show ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type VLAN Interface
------------------ --------------- ---------- ------------- ---- --------------------
00:50:56:89:1A:2B 10.10.10.51 85740 dhcp-snooping 10 GigabitEthernet1/0/5
Total number of bindings: 1The database line stores the table in flash so it survives a reload.
They will ask next
Which port do you trust?
The one the server's replies arrive on: the uplink toward the distribution switch, relay or DHCP server. Never a user-facing port, and not a port toward a downstream switch you do not control.
Does DHCP snooping affect hosts with static IP addresses?
Not by itself, but those hosts have no binding, so DAI and IP Source Guard will drop them unless you add static entries.
Traps
- Enabling
ip dhcp snoopingglobally but not for any VLAN. Nothing is snooped. - Forgetting to trust the uplink. Every client in the VLAN stops getting leases.